curl --request GET \
--url https://api.cloudcruise.com/vault/tfa-code \
--header 'cc-key: <api-key>'import requests
url = "https://api.cloudcruise.com/vault/tfa-code"
headers = {"cc-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'cc-key': '<api-key>'}};
fetch('https://api.cloudcruise.com/vault/tfa-code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloudcruise.com/vault/tfa-code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"cc-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.cloudcruise.com/vault/tfa-code"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("cc-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.cloudcruise.com/vault/tfa-code")
.header("cc-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloudcruise.com/vault/tfa-code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["cc-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"type": "authenticator",
"code": "123456",
"expires_in_seconds": 23,
"received_at": "2023-11-07T05:31:56Z"
}{
"statusCode": 400,
"message": "Both permissioned_user_id and domain are required",
"error": "Bad Request"
}{
"statusCode": 403,
"message": "Verification email preview is not available for this credential. Contact support.",
"error": "Forbidden"
}{
"statusCode": 404,
"message": "No recent code available",
"error": "Not Found"
}{
"statusCode": 409,
"message": "SMS code retrieval requires a dedicated phone number for this workspace",
"error": "Conflict"
}{
"statusCode": 422,
"message": "Invalid TFA secret",
"error": "Unprocessable Entity"
}Get 2FA code
Retrieves the current two-factor authentication (2FA) code for a single vault entry, identified by permissioned_user_id and domain.
Behavior depends on the credential’s 2FA method:
- Authenticator (TOTP): a fresh time-based code is generated from the
stored secret. The response includes
expires_in_seconds. - Email: returns the most recently received code, provided it arrived
within the freshness window (otherwise 404). The response includes
received_at. - SMS and magic link: not supported via this endpoint (409). SMS codes arrive at a single shared phone number with no per-credential marker (and the message body often has no service name), so a code cannot be reliably attributed to the requested credential. Use email or authenticator.
The code is returned with Cache-Control: no-store and is never logged.
curl --request GET \
--url https://api.cloudcruise.com/vault/tfa-code \
--header 'cc-key: <api-key>'import requests
url = "https://api.cloudcruise.com/vault/tfa-code"
headers = {"cc-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'cc-key': '<api-key>'}};
fetch('https://api.cloudcruise.com/vault/tfa-code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloudcruise.com/vault/tfa-code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"cc-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.cloudcruise.com/vault/tfa-code"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("cc-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.cloudcruise.com/vault/tfa-code")
.header("cc-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloudcruise.com/vault/tfa-code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["cc-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"type": "authenticator",
"code": "123456",
"expires_in_seconds": 23,
"received_at": "2023-11-07T05:31:56Z"
}{
"statusCode": 400,
"message": "Both permissioned_user_id and domain are required",
"error": "Bad Request"
}{
"statusCode": 403,
"message": "Verification email preview is not available for this credential. Contact support.",
"error": "Forbidden"
}{
"statusCode": 404,
"message": "No recent code available",
"error": "Not Found"
}{
"statusCode": 409,
"message": "SMS code retrieval requires a dedicated phone number for this workspace",
"error": "Conflict"
}{
"statusCode": 422,
"message": "Invalid TFA secret",
"error": "Unprocessable Entity"
}Note:
- Both
permissioned_user_idanddomainare required.- For authenticator (TOTP) credentials, a fresh code is generated and the response includes
expires_in_seconds.- For email credentials, the most recently received code is returned if it arrived within the freshness window; otherwise a
404is returned. The response includesreceived_at.- SMS and magic-link credentials are not supported on this endpoint (
409). SMS codes arrive at a single shared phone number with no per-credential marker (and the message body often has no service name), so they can’t be reliably attributed to the requested credential — use email or authenticator.- Codes are returned with
Cache-Control: no-store. Do not log or cache them.
Authorizations
API key-based authentication. Provide your CloudCruise API key in the cc-key header.
Query Parameters
Unique identifier for the vault entry.
Target domain of the vault entry.
Response
2FA code successfully retrieved.
The current 2FA code for a vault entry. expires_in_seconds is present
for authenticator (TOTP) codes; received_at is present for email/SMS
codes.
The 2FA method this code was produced for.
authenticator, email The one-time code.
"123456"
Seconds until the authenticator code rotates (authenticator only).
23
When the email/SMS code was received (email/SMS only).
Was this page helpful?

